Oracle WebLogic must provide the ability to write specified audit record content to an audit log server.

From Oracle WebLogic Server 12c Security Technical Implementation Guide

Part of SRG-APP-000102-AS-000064

Associated with: CCI-000136

SV-70503r1_rule Oracle WebLogic must provide the ability to write specified audit record content to an audit log server.

Vulnerability discussion

Information system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application specific events, success/fail indications, filenames involved, access control or flow control rules invoked. Centralized management of audit records and logs provides for efficiency in maintenance and management of records, as well as the backup and archiving of those records. Application servers and their related components are required to be capable of writing logs to centralized audit log servers.

Check content

1. Access EM 2. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'JDBC Data Sources' 3. From the list of data sources, select the one named 'opss-audit-DBDS', which connects to the IAU_APPEND schema of the audit database. Note the value in the 'JNDI name' field 4. To verify, select 'Configuration' tab -> 'Connection Pool' tab 5. Ensure the 'URL' and 'Properties' fields contain the correct connection values for the IAU_APPEND schema 6. To test, select 'Monitoring' tab, select a server from the list and click 'Test Data Source'. Ensure test was successful. Repeat for each server in the list 7. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Security Provider Configuration' 8. Beneath 'Audit Service' section, click 'Configure' button 9. Ensure 'Data Source JNDI Name' value matches the JNDI Name value from data source in step 3 above 10. Repeat steps 2-6 for data source named 'wls-wldf-storeDS' and WLS schema If the location for audit data is not an audit log server, this is a finding.

Fix text

1. Access AC 2. From 'Domain Structure', select 'Services' -> 'Data Sources' 3. Utilize 'Change Center' to create a new change session 4. Click 'New' data source to create a new data source for the audit data store using schema IAU_APPEND 5. Enter database details and JNDI name, click through wizard 6. Select all servers and clusters available as targets to deploy this data source to 7. Finish creating the data source and record the JNDI name 8. Access EM 9. Select the domain from the navigation tree, and use the dropdown to select 'WebLogic Domain' -> 'Security' -> 'Security Provider Configuration' 10. Beneath 'Audit Service' section, click 'Configure' button 11. Set the values for the IAU_APPEND schema and save configuration 12. Repeat steps 2-7 for data source named 'wls-wldf-storeDS' and WLS schema

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer